The Dark Arts of Social Engineering – SANS Security Awareness Summit 2018

Jen Fox shares insights she has gained through her experiences as a social engineer. What exactly is social engineering and what goes into a social engineering campaign? What does social engineering look like and what tricks or techniques has Jen found to be the most successful? Most importantly, what has she found to make people and/or organizations more resilient to these attacks? Jen will share various real world stories, to include recorded conversations of real social engineering attacks.

[Ubermicropwned]

You guys genuinely are fools to think this doesn't work. Most ppl are scared of being scolded by their boss so if you put yourself as an authority figure they'll do what you ask within reason.

[PirateRadioPodcasts]

SANS = French meaning "WITHOUT." Reminds us of what the WEF told us: "You will own NOTHING, and BE HAPPY."

[TorySlusher]

See, when I think of social engineering I think of a machine or group of people mentally steering others to do their bidding... Typically without their knowledge of the larger intention or hidden agenda.

[ktex]

Social Engineering- When they hijack a term that means something completely different than what they tell you it does, so you can't easily get information on the REAL meaning of the terminology. 🤦

[rainbowbgood]

I used to do telemarketing. Kindof similar, wierdly. Works well if you create a friendly connection that's combined with aggression. Guess some self-help stuff and cult stuff follows this model. In a way they are using concepts that seem unique to you and your experiences in life that no one ever talks about but everyone experiences to create familiarity and trust and establish themselves as credible and then throw in whatever they want you to believe.

[sahib]

Love ur videos sans very educational & i really want to study 📖 ur material ☺️

[jermainerace]

That book is now up to 8.99, unfortunately.

[msheart]

And she thinks it"s funny. Read John Coleman's book " The Tavistock Institution Of Human Relations"

[Cybizar]

Every time you call help lines they record your voice and fuck you up, this is exactly what I get on the helpline, lifeline, mensline, suicide line etc

[summary]

- 4:28 about 50\% of people even share their password in a phone call
- 7:40 the hacker leverages what is current (!) in the victims life. (related / exploitable topics in public news or personal changes in the victims life)
- 8:11 the hacker leverages credibility that others have built (trust in friends, business partners, police, ...)
- 9:02 the hacker will try to use the same terminology as the victim (department names, ...)
- 20:17 the hacker walks the victim through a complex procedure and make sthe victim comply a lot of times until so the victim gets used to complying.
- 21:55 the attack demands in instant response from the victim to put it under pressure
- 22:36 the hacker puts the victim into a position in which it has to violate social norms to resist the attack
- 6:55 attacks might reward you with a fake-reward that seems feasible (a small voucher for the cafeteria, ...)
- 27:26 hacker might not ask directly for information, but instead first get your trust, and ask you to give your information during a follow-up interaction.
- 35:00 the hacker first garners information from people around the actual victim that are easier to hack. The hacker then uses that information to seem more credible for the victim.
- 36:46 talk to others if you feel like you might had an interaction with a hacker. there might be a second interaction with the hacker.


for employers:
- 35:45 uncertainty puts your employees under pressure. Define processes that one has to stick to in special situations that might be simulated by a hacker.
- 37:08 your employees have to know that it is okay to insist on sharing critical information in secure ways only.

Thanks for uploading this great video!

[lwzfog]

The Tavistock Institute & Eugenics - know your history

[squishrabbit]

Love how the audience cheered for the girl who wouldn't give her password out, that was cute 🙂🎉

[godsmasonbyraymasonbuildin]

The only time a person gets my password is if they're IT and actually been contacted by me already and I'm on the call.

[erocdj]

There's a million ways to get paid

[elbowsout]

What a great video thanks Jen. I'm definitely going to look at spear phishing people in my org with the birthday coffee email.

[beneiseoleinmheart]

She kind of reminds me of Joyce Meyers for some reason.

[anahering]

Living in a place where criminals often call you from jail, this would never work. NO info is given over the phone. Period.

[adamsarwar]

Amanda sounds nasally and meek, but she's sharp as a fox! Especially the asking for the number part. hehe

[stephenconnell]

Have IQ's dropped that badly? "I want to do this and that with your system because of Blah Blah or this person in the company said I could" The most powerful response? NO but if you give me your name and details I will notify the appropriate person. End of story no matter what is said next.

[dewayneweaver]

No Indian accent so she should have known it wasn't legit.